U.S. Coast Guard Issues Landmark Cybersecurity Rule to Protect Maritime Infrastructure
final rule on January 17 establishing minimum cybersecurity requirements for U.S.-flagged vessels and other regulated facilities. The landmark rule aims to strengthen the resilience of the critical maritime infrastructure against cyberattacks, though its success will hinge on whether infrastructure owners and the Coast Guard itself have adequate resources for effective implementation.
Minimum Requirements Include Cyber Hygiene and Incident Response and Reporting
The final rule — building on a proposed rule and an executive order both issued in February 2024 — requires regulated entities to develop and maintain cybersecurity plans. These plans must include cyber hygiene practices like passwords and access management as well as asset inventories, logging network activity, and data encryption.
Entities must also develop cyber incident response plans and designate cybersecurity officers responsible for implementing these plans, conducting annual audits, coordinating inspections and training, and mitigating cyber threats. Finally, the rule requires regulated entities to report cyber incidents to the National Response Center, the FBI, and the Cybersecurity and Infrastructure Security Agency, ensuring rapid notification and information sharing across relevant agencies.
America’s Ports Face an Evolving Cyber Threat From China
The final rule comes at a time of increasingly sophisticated cyber threats targeting the maritime transportation system. A December 2024 report by DNV, a leading maritime registrar and technical standards organization, revealed that 31 percent of maritime professionals reported at least one cyberattack in the past year — nearly double the rate reported in the previous five years. Meanwhile, government officials and cybersecurity firms alike have warned that malicious Chinese hackers burrowed deep into U.S. critical infrastructure — including transportation infrastructure — to be able to disrupt and disable operations at a time of Beijing’s choosing.